simpleaudit-studio 0.2.7__tar.gz → 0.3.1__tar.gz

{simpleaudit_studio-0.2.7 → simpleaudit_studio-0.3.1}/.dockerignore

@@ -1,12 +1,18 @@
 .git
+.github
 .env
+.env.local
 .venv
 __pycache__/
 *.pyc
+*.sqlite3
+*.sqlite3-*
+app.pid
 data/
 staticfiles/
-media/
 .pytest_cache/
 .mypy_cache/
 .ruff_cache/
-# sync 1790239341
+docs/
+e2e/
+copilot-instructions.md

{simpleaudit_studio-0.2.7 → simpleaudit_studio-0.3.1}/.env.example

@@ -8,14 +8,14 @@
 # For a local (non-Docker) development setup, copy `.env.local.example` instead.
 #
 # NOTE: docker-compose.yml overrides a few values per service (POSTGRES_HOST,
-# HATCHET_*, MINIO_ENDPOINT) so the container-internal hostnames are used
+# HATCHET_*) so the container-internal hostnames are used
 # regardless of what is written here.
 # =============================================================================
 
 # --- Django -----------------------------------------------------------------
 DJANGO_SECRET_KEY=change-me
 DJANGO_DEBUG=false
-DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1
+DJANGO_ALLOWED_HOSTS=*
 LOG_LEVEL=INFO
 
 # --- Bootstrap (idempotent; run automatically by the web container) ----------
@@ -46,14 +46,6 @@ POSTGRES_PASSWORD=change-me
 POSTGRES_HOST=postgres
 POSTGRES_PORT=5432
 
-# --- MinIO / S3-compatible object storage (OFF by default) --------------------
-# Enable with: docker compose --profile storage up -d
-# Then uncomment and set real credentials:
-# MINIO_ENDPOINT=http://minio:9000
-# MINIO_ACCESS_KEY=change-me
-# MINIO_SECRET_KEY=change-me
-# MINIO_BUCKET=simpleaudit-artifacts
-
 # --- Durable workflow system (Hatchet) ----------------------------------------
 # Docker Compose: the compose service name `hatchet-server` resolves inside the
 # compose network. HTTP API on :8888, gRPC on :7077 (see docker-compose.yml).
@@ -76,9 +68,6 @@ HATCHET_TLS_STRATEGY=none
 WORKER_POOL=cpu
 
 # --- Operational limits --------------------------------------------------------
-MAX_CONCURRENT_AUDITS=2
-MAX_SCENARIOS_PER_RUN=500
-SSE_MAX_CONNECTIONS_PER_USER=10
 
 # --- SimpleAudit engine ---------------------------------------------------------
 # No configuration needed here. The engine is a normal pip dependency pinned in
@@ -99,10 +88,6 @@ SSE_MAX_CONNECTIONS_PER_USER=10
 SEED_DEMO_AUDITS=true
 
 # --- Optional observability -----------------------------------------------------
-OTEL_EXPORTER_OTLP_ENDPOINT=
-LANGFUSE_PUBLIC_KEY=
-LANGFUSE_SECRET_KEY=
-LANGFUSE_HOST=
 
 # --- Sentry error tracking & tracing (leave empty to disable) -------------------
 SENTRY_DSN=
@@ -113,5 +98,3 @@ SENTRY_ENVIRONMENT=development
 # WORKOS_CLIENT_ID is public; WORKOS_API_KEY is server-side secret (keep out of git).
 WORKOS_CLIENT_ID=
 WORKOS_API_KEY=
-# Public base URL used to build the OAuth redirect URI, e.g. http://localhost:8000
-APP_BASE_URL=http://localhost:8000

{simpleaudit_studio-0.2.7 → simpleaudit_studio-0.3.1}/.env.local.example

@@ -17,7 +17,7 @@
 # --- Django -----------------------------------------------------------------
 DJANGO_SECRET_KEY=local-dev-key-not-for-prod
 DJANGO_DEBUG=true
-DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1
+DJANGO_ALLOWED_HOSTS=*
 LOG_LEVEL=DEBUG
 
 # --- Bootstrap ----------------------------------------------------------------
@@ -80,13 +80,5 @@ WORKER_POOL=cpu
 # SIMULACHAT_API_KEY=sk-...
 
 # --- Optional (leave empty to disable) ------------------------------------------
-MINIO_ENDPOINT=
-MINIO_ACCESS_KEY=
-MINIO_SECRET_KEY=
-MINIO_BUCKET=simpleaudit-artifacts
-OTEL_EXPORTER_OTLP_ENDPOINT=
-LANGFUSE_PUBLIC_KEY=
-LANGFUSE_SECRET_KEY=
-LANGFUSE_HOST=
 SENTRY_DSN=
 SENTRY_ENVIRONMENT=development

simpleaudit_studio-0.3.1/.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+    paths-ignore: ["docs/**", "**.md", "LICENSE"]
+  pull_request:
+    paths-ignore: ["docs/**", "**.md", "LICENSE"]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    env:
+      DJANGO_SETTINGS_MODULE: config.settings
+      DJANGO_SECRET_KEY: ci-secret-key
+      DJANGO_DEBUG: "false"
+      DJANGO_ALLOWED_HOSTS: "*"
+      SIMPLEAUDIT_LOCAL_SQLITE: "1"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0   # the embedded-Hatchet step diffs against origin/main
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - uses: astral-sh/setup-uv@v7
+      - name: Install dependencies
+        run: uv sync --frozen --extra dev
+      - name: Lint (ruff)
+        run: uv run ruff check .
+      - name: Run tests (parallel)
+        run: uv run python manage.py test infra --parallel auto --exclude-tag embedded_hatchet
+      - name: Check if embedded Hatchet files changed
+        id: hatchet-changed
+        run: |
+          CHANGED=$(git diff --name-only origin/main...HEAD -- infra/minimal_config.py infra/worker.py 2>/dev/null || true)
+          if [ -n "$CHANGED" ]; then echo "changed=true" >> "$GITHUB_OUTPUT"; else echo "changed=false" >> "$GITHUB_OUTPUT"; fi
+      - name: Run tests (embedded Hatchet, serial)
+        if: steps.hatchet-changed.outputs.changed == 'true'
+        run: uv run python manage.py test infra.tests.test_minimal_config.TestEmbeddedHatchetLifecycle

simpleaudit_studio-0.3.1/.github/workflows/docker.yml

@@ -0,0 +1,46 @@
+name: Docker build
+
+# Builds both images (no push) only when something that affects them changes,
+# so Dockerfile / dependency / settings breakage is caught before deploying.
+on:
+  push:
+    branches: [main]
+    paths:
+      - "Dockerfile"
+      - "deploy/**"
+      - "docker-compose.yml"
+      - ".dockerignore"
+      - "pyproject.toml"
+      - "uv.lock"
+      - "config/settings.py"
+      - "infra/minimal_config.py"
+      - "simpleaudit_studio/**"
+      - ".github/workflows/docker.yml"
+  pull_request:
+    paths:
+      - "Dockerfile"
+      - "deploy/**"
+      - "docker-compose.yml"
+      - ".dockerignore"
+      - "pyproject.toml"
+      - "uv.lock"
+      - "config/settings.py"
+      - "infra/minimal_config.py"
+      - "simpleaudit_studio/**"
+      - ".github/workflows/docker.yml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build HF Space / demo image
+        run: docker build -t simpleaudit-studio:ci .
+      - name: Build Compose image
+        run: docker build -f deploy/compose/Dockerfile -t simpleaudit-studio-compose:ci .
+      - name: Validate compose file
+        run: cp .env.example .env && docker compose config --quiet

{simpleaudit_studio-0.2.7 → simpleaudit_studio-0.3.1}/.github/workflows/publish.yml

@@ -20,7 +20,16 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-      - name: Install dependencies
+      - uses: astral-sh/setup-uv@v7
+      - name: Test before publishing
+        env:
+          DJANGO_SECRET_KEY: ci-secret-key
+          SIMPLEAUDIT_LOCAL_SQLITE: "1"
+        run: |
+          uv sync --frozen --extra dev
+          uv run ruff check .
+          uv run python manage.py test infra --parallel auto --exclude-tag embedded_hatchet
+      - name: Install build tooling
         run: |
           python -m pip install --upgrade pip
           pip install build

{simpleaudit_studio-0.2.7 → simpleaudit_studio-0.3.1}/.gitignore

@@ -8,6 +8,7 @@ venv/
 # Django
 db.sqlite3
 *.sqlite3
+*.sqlite3-*
 media/
 staticfiles/
 

{simpleaudit_studio-0.2.7 → simpleaudit_studio-0.3.1}/Dockerfile

@@ -29,47 +29,47 @@ RUN apt-get update \
 
 # --- Python dependencies -----------------------------------------------------
 # pyproject.toml is the single source of truth; uv.lock pins exact versions.
-# The postgres extra is included because Django imports the psycopg driver at
-# startup even when SIMPLEAUDIT_MINIMAL=1 uses SQLite for the domain DB.
 # uv sync creates /app/.venv; the PATH update keeps the `python` entrypoint.
 COPY pyproject.toml uv.lock README.md ./
 RUN pip install uv \
-    && uv sync --frozen --no-install-project --no-dev --extra postgres
+    && uv sync --frozen --no-install-project --no-dev
 ENV PATH="/app/.venv/bin:$PATH"
 
-# --- Application code --------------------------------------------------------
-COPY . .
-
-# Collect static files so Django can serve them without DEBUG.
-RUN python manage.py collectstatic --noinput
-
-# --- Non-root user ------------------------------------------------------------
-RUN useradd --create-home appuser \
-    && mkdir -p /app/staticfiles /app/media \
-    && chown -R appuser:appuser /app
-USER appuser
-
 # --- Environment defaults for the Space --------------------------------------
 # SIMPLEAUDIT_MINIMAL=1 enables the minimal config path (SQLite + embedded Hatchet).
 # Override via HF Space Secrets for anything sensitive.
+# Must be set BEFORE collectstatic: Django settings select the DB engine from it,
+# and the postgres driver is an optional extra not installed in this image.
 ENV SIMPLEAUDIT_MINIMAL=1 \
     PORT=7860 \
     DJANGO_SECRET_KEY=hf-space-demo-secret-key-change-in-production \
     DJANGO_DEBUG=false \
-    DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,.hf.space,.huggingface.co \
+    DJANGO_ALLOWED_HOSTS=* \
     BOOTSTRAP_USERNAME=studio \
     BOOTSTRAP_EMAIL=studio@example.local \
     BOOTSTRAP_PASSWORD=admin123 \
     BOOTSTRAP_PROJECT_NAME=Default \
     DEMO_MODE=true \
     DEMO_USERNAME=studio \
-    DEMO_PASSWORD=admin123 \
-    MAX_CONCURRENT_AUDITS=1 \
-    MAX_SCENARIOS_PER_RUN=50
+    DEMO_PASSWORD=admin123
+
+# --- Application code --------------------------------------------------------
+COPY . .
+
+# Collect static files so Django can serve them without DEBUG.
+RUN python manage.py collectstatic --noinput
+
+# --- Non-root user ------------------------------------------------------------
+RUN useradd --create-home appuser \
+    && mkdir -p /app/staticfiles \
+    && chown -R appuser:appuser /app
+USER appuser
 
 EXPOSE 7860
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=90s --retries=5 \
     CMD curl -fsS http://localhost:7860/healthz || exit 1
 
+# Model connections point at OpenAI's real base URL (https://api.openai.com/v1).
+# Users add their API key in the UI to run real audits.
 CMD ["python", "-m", "simpleaudit_studio.cli"]

{simpleaudit_studio-0.2.7 → simpleaudit_studio-0.3.1}/PKG-INFO

@@ -1,16 +1,16 @@
 Metadata-Version: 2.5
 Name: simpleaudit-studio
-Version: 0.2.7
+Version: 0.3.1
 Summary: Production AI model audit platform — one-liner demo mode via uvx
 License: MIT
 License-File: LICENSE
 Requires-Python: >=3.11
-Requires-Dist: boto3==1.40.4
-Requires-Dist: django-cors-headers==4.7.0
+Requires-Dist: cronsim==2.7
 Requires-Dist: django==5.2.4
 Requires-Dist: djangorestframework==3.16.0
 Requires-Dist: drf-spectacular==0.28.0
 Requires-Dist: hatchet-sdk==1.41.0
+Requires-Dist: httpx>=0.27
 Requires-Dist: pydantic<3,>=2.7
 Requires-Dist: python-dotenv==1.1.1
 Requires-Dist: requests==2.32.5
@@ -19,9 +19,9 @@ Requires-Dist: simpleaudit==0.2.1
 Requires-Dist: workos==10.4.0
 Provides-Extra: dev
 Requires-Dist: factory-boy==3.3.2; extra == 'dev'
-Requires-Dist: pytest; extra == 'dev'
-Requires-Dist: pytest-django; extra == 'dev'
 Requires-Dist: ruff; extra == 'dev'
+Provides-Extra: e2e
+Requires-Dist: playwright>=1.45; extra == 'e2e'
 Provides-Extra: postgres
 Requires-Dist: psycopg[binary]==3.2.13; extra == 'postgres'
 Provides-Extra: server
@@ -78,7 +78,7 @@ The pre-seeded connections point at a built-in mock server. To run real audits,
 | Together AI | `https://api.together.xyz/v1` | Many open models |
 | Groq | `https://api.groq.com/openai/v1` | Fast inference |
 
-Set the API key in the connection form (leave blank for local servers that don't require auth), then launch an audit from the Scenario Library.
+Set the API key in the connection form (leave blank for local servers that don't require auth), then start a run from **New Experiment**.
 
 ## 🛠️ Local Development
 
@@ -95,7 +95,7 @@ cd SimpleAuditStudio
 cp .env.local.example .env          # minimal local config (SQLite + mock models)
 
 uv sync --extra dev --extra postgres   # create .venv + install all deps
-uv run manage.py setup_local           # migrate + create admin (studio/admin123) + seed data
+uv run manage.py setup_local           # migrate + create admin (studio / BOOTSTRAP_PASSWORD from .env) + seed data
 ```
 
 `setup_local` chains the three idempotent first-run steps (migrate → bootstrap admin → seed scenario packs & model connections) into one command. Re-run it any time — it skips what already exists.
@@ -125,22 +125,22 @@ cp .env.example .env
 docker compose up -d
 ```
 
-Services: Web UI (:8000), PostgreSQL, Hatchet queue (:8888), Worker. Optional profiles: `--profile storage` (MinIO), `--profile mock` (mock model API).
+Services: Web UI (:8000), PostgreSQL, Hatchet queue (:8888), Worker. Optional profile: `--profile mock` (mock model API).
 
 See [docs/deployment.md](docs/deployment.md) for production hardening, backups, and upgrades.
 
 ## ✨ What You Can Do
 
-- Browse the scenario library and create new audit scenarios
-- Register model endpoints (OpenAI-compatible APIs)
-- Launch audits and watch live progress
-- Compare results across runs
-- Explore the visualizer for detailed analysis
+- Build versioned scenario sets and register OpenAI-compatible models
+- Run experiments across models, scenario versions and settings, with a review step before launch
+- Watch runs live, including per-repetition results
+- Monitor models for drift on a schedule (interval or cron)
+- Filter, customise and compare runs on an interactive dashboard
 
 ## 🏗️ Architecture
 
 ```
-Browser → Django/Gunicorn (:7860)
+Browser → Django (gunicorn :8000 in Compose; runserver :7860 in the HF Space / uvx demo)
               ↓
          PostgreSQL 16 (domain + queue DBs)
               ↓
@@ -159,11 +159,3 @@ Browser → Django/Gunicorn (:7860)
 ## 🤝 Contributing
 
 Architecture decisions are documented in [docs/architecture.md](docs/architecture.md).
-
-
-
-
-
-
-
-

{simpleaudit_studio-0.2.7 → simpleaudit_studio-0.3.1}/README.md

@@ -48,7 +48,7 @@ The pre-seeded connections point at a built-in mock server. To run real audits,
 | Together AI | `https://api.together.xyz/v1` | Many open models |
 | Groq | `https://api.groq.com/openai/v1` | Fast inference |
 
-Set the API key in the connection form (leave blank for local servers that don't require auth), then launch an audit from the Scenario Library.
+Set the API key in the connection form (leave blank for local servers that don't require auth), then start a run from **New Experiment**.
 
 ## 🛠️ Local Development
 
@@ -65,7 +65,7 @@ cd SimpleAuditStudio
 cp .env.local.example .env          # minimal local config (SQLite + mock models)
 
 uv sync --extra dev --extra postgres   # create .venv + install all deps
-uv run manage.py setup_local           # migrate + create admin (studio/admin123) + seed data
+uv run manage.py setup_local           # migrate + create admin (studio / BOOTSTRAP_PASSWORD from .env) + seed data
 ```
 
 `setup_local` chains the three idempotent first-run steps (migrate → bootstrap admin → seed scenario packs & model connections) into one command. Re-run it any time — it skips what already exists.
@@ -95,22 +95,22 @@ cp .env.example .env
 docker compose up -d
 ```
 
-Services: Web UI (:8000), PostgreSQL, Hatchet queue (:8888), Worker. Optional profiles: `--profile storage` (MinIO), `--profile mock` (mock model API).
+Services: Web UI (:8000), PostgreSQL, Hatchet queue (:8888), Worker. Optional profile: `--profile mock` (mock model API).
 
 See [docs/deployment.md](docs/deployment.md) for production hardening, backups, and upgrades.
 
 ## ✨ What You Can Do
 
-- Browse the scenario library and create new audit scenarios
-- Register model endpoints (OpenAI-compatible APIs)
-- Launch audits and watch live progress
-- Compare results across runs
-- Explore the visualizer for detailed analysis
+- Build versioned scenario sets and register OpenAI-compatible models
+- Run experiments across models, scenario versions and settings, with a review step before launch
+- Watch runs live, including per-repetition results
+- Monitor models for drift on a schedule (interval or cron)
+- Filter, customise and compare runs on an interactive dashboard
 
 ## 🏗️ Architecture
 
 ```
-Browser → Django/Gunicorn (:7860)
+Browser → Django (gunicorn :8000 in Compose; runserver :7860 in the HF Space / uvx demo)
               ↓
          PostgreSQL 16 (domain + queue DBs)
               ↓
@@ -129,11 +129,3 @@ Browser → Django/Gunicorn (:7860)
 ## 🤝 Contributing
 
 Architecture decisions are documented in [docs/architecture.md](docs/architecture.md).
-
-
-
-
-
-
-
-

{simpleaudit_studio-0.2.7 → simpleaudit_studio-0.3.1}/accounts/migrations/0001_initial.py

@@ -1,4 +1,4 @@
-# Generated by Django 5.2.4 on 2026-09-23 12:05
+# Generated by Django 5.2.4 on 2026-09-27 19:42
 
 import django.contrib.auth.models
 import django.contrib.auth.validators
@@ -31,6 +31,7 @@ class Migration(migrations.Migration):
                 ("name", models.CharField(max_length=200, unique=True)),
                 ("slug", models.SlugField(max_length=200, unique=True)),
                 ("description", models.TextField(blank=True)),
+                ("archived", models.BooleanField(db_index=True, default=False)),
                 ("created_at", models.DateTimeField(auto_now_add=True)),
                 ("updated_at", models.DateTimeField(auto_now=True)),
             ],
@@ -121,6 +122,10 @@ class Migration(migrations.Migration):
                         default=django.utils.timezone.now, verbose_name="date joined"
                     ),
                 ),
+                (
+                    "workos_user_id",
+                    models.CharField(blank=True, max_length=64, null=True, unique=True),
+                ),
                 (
                     "groups",
                     models.ManyToManyField(

simpleaudit_studio-0.2.7/accounts/migrations/0002_user_workos_user_id.py → simpleaudit_studio-0.3.1/accounts/migrations/0002_user_preferences.py

@@ -1,4 +1,4 @@
-# Generated by Django 5.2.4 on 2026-09-24 13:27
+# Generated by Django 5.2.4 on 2026-09-27 20:23
 
 from django.db import migrations, models
 
@@ -11,7 +11,7 @@ class Migration(migrations.Migration):
     operations = [
         migrations.AddField(
             model_name="user",
-            name="workos_user_id",
-            field=models.CharField(blank=True, max_length=64, null=True, unique=True),
+            name="preferences",
+            field=models.JSONField(blank=True, default=dict),
         ),
     ]

{simpleaudit_studio-0.2.7 → simpleaudit_studio-0.3.1}/accounts/models.py

@@ -21,6 +21,9 @@ class User(AbstractUser):
 
     # Stable WorkOS AuthKit user id; null for locally-created accounts.
     workos_user_id = models.CharField(max_length=64, unique=True, null=True, blank=True)
+    # Per-user UI preferences (e.g. dashboard column layout). Keys are
+    # whitelisted by the preference endpoint; values are small JSON.
+    preferences = models.JSONField(default=dict, blank=True)
 
     groups = models.ManyToManyField(
         "auth.Group",

{simpleaudit_studio-0.2.7 → simpleaudit_studio-0.3.1}/accounts/serializers.py

@@ -36,13 +36,6 @@ class RegisterSerializer(serializers.Serializer):
         return User.objects.create_user(**validated_data)
 
 
-class ProjectSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = Project
-        fields = ("id", "name", "slug", "description", "created_at", "updated_at")
-        read_only_fields = ("id", "created_at", "updated_at")
-
-
 class WorkspaceItemSerializer(serializers.ModelSerializer):
     """Workspace as shown in lists/detail, including whether the requesting
     user can administer it (drives UI affordances)."""

{simpleaudit_studio-0.2.7 → simpleaudit_studio-0.3.1}/accounts/services.py

@@ -392,7 +392,7 @@ def admin_stats_payload() -> dict:
             "audit_run_completed": run_status_totals.get("completed", 0),
             "audit_run_failed": run_status_totals.get("failed", 0),
             "audit_run_active": sum(
-                n for status, n in run_status_totals.items() if status not in ("completed", "failed", "cancelled")
+                n for status, n in run_status_totals.items() if status not in AuditRun.TERMINAL_STATUSES
             ),
             "scenario_count": Scenario.objects.count(),
             "scenario_set_count": ScenarioSet.objects.count(),
@@ -400,3 +400,12 @@ def admin_stats_payload() -> dict:
         },
         "workspaces": workspaces,
     }
+
+
+def is_any_project_admin(user) -> bool:
+    """Superuser, or ADMIN in at least one workspace (gates system-wide pages like Health)."""
+    if not user or not user.is_authenticated:
+        return False
+    if user.is_superuser:
+        return True
+    return ProjectMembership.objects.filter(user=user, role=ProjectMembership.Role.ADMIN).exists()

{simpleaudit_studio-0.2.7 → simpleaudit_studio-0.3.1}/accounts/views.py

@@ -327,27 +327,6 @@ def update_or_remove_member(request, project_id, user_id):
     return Response(ProjectMembershipSerializer(membership).data)
 
 
-# ─── Legacy aliases (kept for backward compatibility) ────────────────────────
-
-
-@api_view(["GET"])
-@permission_classes([IsAuthenticated])
-def list_projects(request):
-    return list_workspaces(request)
-
-
-@api_view(["POST"])
-@permission_classes([IsAuthenticated])
-def create_project(request):
-    return create_workspace_view(request)
-
-
-@api_view(["GET"])
-@permission_classes([IsAuthenticated])
-def get_project(request, project_id):
-    return workspace_detail(request, project_id)
-
-
 def _get_project_or_404(project_id) -> Project:
     try:
         return Project.objects.get(pk=project_id)

{simpleaudit_studio-0.2.7 → simpleaudit_studio-0.3.1}/accounts/workos_auth.py

@@ -1,10 +1,9 @@
-"""WorkOS AuthKit integration (passwordless email verification + SSO).
+"""WorkOS Magic Auth integration (passwordless email verification).
 
 Flow:
-  1. ``build_authorization_url`` sends the browser to WorkOS's hosted login UI.
-  2. WorkOS redirects back to ``/auth/workos/callback/`` with a one-time code.
-  3. ``exchange_code_for_user`` trades the code for an authenticated user and
-     returns the local Django user (created on first sign-in).
+  1. ``send_magic_auth_code`` emails the user a one-time code.
+  2. ``authenticate_magic_auth`` checks the code and returns the local Django
+     user (created on first sign-in).
 
 The WorkOS API key is server-side only; the client ID is safe to expose in
 templates. Neither secret is ever stored on the User model — identity is
@@ -26,31 +25,6 @@ def _client():
     return WorkOSClient(api_key=settings.WORKOS_API_KEY)
 
 
-def build_authorization_url(
-    redirect_uri: str,
-    state: str,
-    login_hint: str | None = None,
-    provider: str | None = None,
-) -> str:
-    """Build the URL that starts the WorkOS AuthKit flow.
-
-    ``login_hint`` pre-fills the user's email and routes to Magic Auth
-    (email code) instead of auto-redirecting to an SSO/OAuth connection.
-    ``provider`` pre-selects a social login provider (e.g. ``GoogleOAuth``,
-    ``MicrosoftOAuth``) so the user goes straight to that IdP.
-    """
-    kwargs: dict = {
-        "client_id": settings.WORKOS_CLIENT_ID,
-        "redirect_uri": redirect_uri,
-        "state": state,
-    }
-    if login_hint:
-        kwargs["login_hint"] = login_hint
-    if provider:
-        kwargs["provider"] = provider
-    return _client().user_management.get_authorization_url(**kwargs)
-
-
 def send_magic_auth_code(email: str, *, ip_address: str | None = None, user_agent: str | None = None):
     """Send a 6-digit Magic Auth code to the given email via WorkOS."""
     _client().user_management.create_magic_auth(
@@ -104,47 +78,6 @@ def authenticate_magic_auth(code: str, email: str, *, ip_address: str | None = N
     return user, created
 
 
-def exchange_code_for_user(code: str, *, ip_address: str | None = None, user_agent: str | None = None):
-    """Exchange an OAuth callback code for a local Django user (SSO/OAuth flow).
-
-    Kept for future SSO support; the primary flow uses Magic Auth directly.
-    """
-    response = _client().user_management.authenticate_with_code(
-        code=code,
-        ip_address=ip_address,
-        user_agent=user_agent,
-    )
-    wo_user = response.user
-    if wo_user is None:
-        raise ValueError("WorkOS returned no user for the authentication code.")
-
-    username = _derive_username(wo_user.email or wo_user.id)
-    user, created = User.objects.get_or_create(
-        workos_user_id=wo_user.id,
-        defaults={
-            "username": username,
-            "email": wo_user.email or "",
-            "first_name": wo_user.first_name or "",
-            "last_name": wo_user.last_name or "",
-            "is_staff": False,
-        },
-    )
-    if not created:
-        changed = False
-        if wo_user.email and user.email != wo_user.email:
-            user.email = wo_user.email
-            changed = True
-        if wo_user.first_name and user.first_name != wo_user.first_name:
-            user.first_name = wo_user.first_name
-            changed = True
-        if wo_user.last_name and user.last_name != wo_user.last_name:
-            user.last_name = wo_user.last_name
-            changed = True
-        if changed:
-            user.save(update_fields=["email", "first_name", "last_name"])
-    return user, created
-
-
 def _derive_username(email_or_id: str) -> str:
     """Derive a unique-ish username from the WorkOS email (or user id)."""
     base = (email_or_id.split("@")[0] if "@" in email_or_id else email_or_id)[:30]